CLAIMS 



1 . A method of classifying a message, including: 

determining the domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 
5 its transmission; 

associating the domain with the IP address; and 

classifying the message based on the associated domain and IP address. 

2. The method of claim 1, further including overriding a white list based on the 
classification. 

10 3. The method of claim 1 , wherein classifying includes determining that the IP 
address is not commonly associated with the domain. 

4. The method of claim 1 , wherein classifying includes checking classifications of 
other messages associated with the same domain and different IP addresses. 

5. The method of claim 1, wherein a plurality of IP addresses is associated with the 
15 domain. 

6. The method of claim 1 , wherein the IP address is associated with a plurality of 
domains. 

7. The method of claim 1 , wherein the IP address is a boundary IP address. 

8. The method of claim 1, wherein the IP address is preconfigured. 

20 9. The method of claim 1 , wherein the IP address is preconfigured to be one hop 
from a gateway IP address. 

10. The method of claim 1, wherein the IP address is learned. 

1 1 . The method of claim 1, wherein the IP address is adaptively determined. 

12. A method of determining a boundary IP address, including: 

25 processing a header to extract a plurality of candidate IP addresses; 

locating a gateway IP address; and 

selecting the boundary IP address based on the location of the gateway IP address. 

13. The method of claim 1, wherein the IP address is a- boundary IP address 
determined according to claim 9. 
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14. The method of claim 1, wherein the domain is the stated sender domain. 

15. The method of claim 1, wherein the domain is the boundary domain. 

16. The method of claim 1, wherein classifying includes consulting a white list. 

17. The method of claim 1, wherein classifying includes classifying the message 
5 based on previous classifications made to the IP address and domain pair. 

18. The method of claim 1 , wherein classifying includes forming a score based on 
previous classifications made to the IP address and domain pair. 

19. The method of claim 1, wherein classifying includes determining a spam ratio. 

20. The method of claim 1, wherein classifying includes determining a spam rate. 
10 21. The method of claim 1 , wherein classifying includes determining an estimated 

instantaneous spam rate. 

22. The method of claim 1 , wherein classifying includes decaying a classification 
variable with time. 

23. The method of claim 1, wherein classifying includes giving a classification 
1 5 greater weight relative to another classification. 

24. The method of claim 1, wherein classifying includes giving a user classification 
greater weight relative to a computer classification. 

25. The method of claim 1, wherein classifying includes giving an indeterminate 
classification a fraction of the weight of a good classification. 

20 26. The method of claim 1, wherein classifying includes consulting a table indexed by 
IP address and domain. 

27. The method of claim 1, wherein classifying includes consulting a table indexed by 
IP address and domain wherein each cell includes information about previous 
classifications. 

25 28. The method of claim 1, further including providing the IP address and domain 
classification as input to another classifier. 

29. The method of claim 1, further including providing the IP address and domain 
classification as input to a Bayesian classifier. 

30. The method of claim 1, wherein classifying includes classifying the message 
30 based on the IP address. 
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3 1 . The method of claim 1 , wherein classifying includes classifying the message 
based on the domain. 

32. The method of claim 1, wherein classifying includes classifying the message 
based on the domain and determining that the message was forged. 

33. The method of claim 1 , wherein classifying includes determining a score for the 
IP address. 

34. The method of claim 1, wherein classifying includes determining a score for the 
domain. 

35. A computer program product for classifying a message, the computer program 
product being embodied in a computer readable medium and comprising computer 
instructions for: 

determining the domain from which the message is purported to be sent; 
determining an IP address from which the message was relayed at some point in 
its transmission; 

associating the domain with the IP address; and 

classifying the message based on the associated domain and IP address. 

36. A system for classifying a message, including a classifier configured to: 
determine the domain from which the message is purported to be sent; 
determine an IP address from which the message was relayed at some point in its 

transmission; 

associate the domain with the IP address; and 

classify the message based on the associated domain and IP address. 
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